External risk intelligence

Chrome Ozone Sandbox Escape Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-10972

This vulnerability is a client-side issue within the Google Chrome web browser. While it requires a crafted HTML page to trigger, browser-based vulnerabilities are local-client-side execution issues rather than internet-facing services, gateways, or infrastructure that would be exposed to the public internet.

Use After Free

Google Chrome

before 149.0.7827.53

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a use-after-free vulnerability in Google Chrome on Linux, which could allow a remote attacker to escape the browser's sandbox through a malicious webpage. While the severity is high, the primary concern is confirming if your organization uses affected versions of Chrome on Linux.

A browser flaw allows remote code execution.
It affects Chrome users on Linux systems.
Confirm relevance and exposure to Chrome on Linux.

Attack Path

How an attacker could exploit the issue

An attacker could lure a user into visiting a malicious webpage, which contains specially crafted HTML. When loaded by a vulnerable version of Chrome on Linux, this page can trigger a use-after-free condition within the Ozone component. Successfully exploiting this could allow an attacker to escape the browser's sandbox.

Entry: Malicious webpage visit.
Trigger: Crafted HTML loads in Chrome.
Risk: Sandbox escape and code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Google Chrome's Ozone component on Linux, when rendered with a specially crafted HTML page, could allow an attacker to escape the browser's sandbox. This means an attacker could potentially gain elevated privileges on the affected system beyond the limitations of the browser environment, when supported by the advisory.

System code execution within the sandbox.
Via a remote, crafted HTML page.
Potential for unauthorized system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Google Chrome on Linux, specifically impacting the Ozone component. Given its nature as a client-side exploit requiring user interaction with a malicious webpage, the primary responsibility for addressing this likely falls to endpoint management, security operations, and potentially application owners who manage the deployed browser instances. The immediate first step is to identify all Linux endpoints running the affected Chrome version, assess their exposure to potentially malicious web content, and then prioritize remediation efforts.

Endpoint or security teams should own remediation.
Verify Chrome versions and user exposure.
Plan updates during scheduled maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome's Ozone component?

Ozone is a platform abstraction layer in the Chromium project that allows the browser to run on different windowing systems. In the context of Google Chrome on Linux, it acts as the bridge between the browser's high-level logic and the underlying Linux graphical environment, helping manage how the browser displays content and handles input events.

What does use-after-free mean for CVE-2026-10972?

This is a memory management error classified as CWE-416. It occurs when a program continues to use a pointer after the memory it references has been cleared or freed. In this vulnerability, an attacker leverages this flaw to manipulate the application's memory state, which can lead to unauthorized code execution or a sandbox escape.

How is this Chrome vulnerability triggered?

The flaw is triggered when a user visits a malicious website containing specially crafted HTML that interacts improperly with the Ozone component. It does not trigger through standard browsing of legitimate websites or by simply having the browser installed; it requires the browser to render the specific, malicious content designed to exploit the memory management error.

Why should I care about this if it is client-side software?

While Halo Surface Signal notes this is a client-side browser issue rather than an internet-facing server service, it remains a risk if your users navigate to malicious content. A sandbox escape allows an attacker to break out of the browser's restricted environment to potentially impact the underlying Linux host system, making it a critical concern for endpoint security.

How do I start addressing CVE-2026-10972?

Begin by auditing your Linux fleet to identify all systems running Chrome versions older than 149.0.7827.53. Once identified, prioritize these endpoints for updates to the latest stable release. Since this is a browser-based threat, ensure your endpoint management processes are capturing these software updates promptly to mitigate the risk posed by potential malicious web interactions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.